Re: [v6ops] new draft: draft-taylor-v6ops-fragdrop

[Fernando Gont <[e-mail]>]

On 10/18/2012 07:31 PM, Mark Andrews wrote:
>> Yes, and part of the reason that packets are not reaching the core infrastr=
>> ucture at line rate is because operators have the ability to examine traffi=
>> c destined for the core infrastructure and filter / rate-limit it to someth=
>> ing reasonable. I may want to allow e.g traceroute to "core" stuff and toss=
>>  that in one rate-limit bucket, but never allow SSH towards my core.  If I =
>> have fragments I have no way of knowing what they are supposed to be part o=
>> f, and so, er=85 =
> 
> So you want allow fragmented ICMP directed at core routers through and are worried
> that some non initial TCP fragments might make it through.  As far as I can tell
> letting through non initial TCP fragments doesn't increase your risk or attack
> surface at all.

If the end-system does not implement RFC5722, then allowng non-initial
fragments might still mean you're not filtering what you expected to be
filtering.

FWIW, we seem to be converging towards RFC5722, but that doesn't mean
everyone is there (e.g., see:
<http://blog.si6networks.com/2012/02/ipv6-nids-evasion-and-improvements-in.html>).

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492